Privacy Policy

1. Who is responsible for your information

Pledzo plays two different roles, depending on whose information it is:

• Donor and supporter data. Nonprofits (“organisations”) use Pledzo to keep records of their donors, event guests, volunteers and gifts. For that data the organisation is in charge (the “controller”) and Pledzo processes it only on the organisation's behalf and instructions (as a “processor” or “service provider”). If you are a donor or guest of an organisation that uses Pledzo, please contact that organisation about your information; we will help them respond.
• Account and website data. For the people who sign up for and use Pledzo, people who contact us, and visitors to pledzo.org, Pledzo decides how the information is used and is responsible for it.

2. What we collect

Information you give us

• Account details: your name, work email address and password (stored only in hashed form by our authentication provider).
• Organisation details: name, type, country, legal name, tax ID, timezone, currency, logo, and your team members' names, emails and roles.
• Messages you send us, for example through the contact form: name, email, organisation, phone, topic and message.

Information organisations store in Pledzo

• Donor and contact records, such as names, contact details, employer and job title, city, LinkedIn profile, interests, notes, relationship owner and stage, and email consent.
• Gifts, pledges, campaigns, events, registrations and attendance, volunteer records, and spreadsheets they import.
• Information people submit through an organisation's public campaign or event pages, such as an event registration.

Information collected automatically

• Technical logs kept by our hosting and database providers: IP address, browser type, pages requested and timestamps, used for security and troubleshooting.
• A few essential cookies (see section 7). We do not use advertising or analytics cookies.

3. How we use information

• To provide Pledzo: sign you in, run your organisation's workspace, import and show your data, and publish the pages you choose to publish.
• To send service emails: welcome messages, team invitations, password resets and replies to your messages.
• To keep Pledzo secure: preventing abuse and spam, investigating problems, and keeping an audit trail of changes.
• To provide support, answer questions, and improve the product based on how it is used and what you tell us.
• To meet legal obligations, such as keeping records or responding to lawful requests.

We use donor and supporter data only to provide the service to the organisation that owns it. We do not sell personal information, we do not use it for advertising, and we do not use one organisation's data for another organisation.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you; our legitimate interests in running, securing and improving Pledzo; your consent where we ask for it; and compliance with legal obligations.

4. Who we share it with

We share personal information only with service providers who help us run Pledzo, under contracts that require them to protect it:

• Supabase: database, sign-in and file storage (servers in the United States).
• Vercel: website and application hosting.
• Resend: delivery of the emails Pledzo sends.
• Unsplash: if a campaign or event uses one of our photo cover templates, the image loads from Unsplash, which receives the viewer's IP address and browser details.
• When paid plans are billed online, a payment provider will process payments. Pledzo will not store card numbers.

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business (in which case this policy will continue to apply). Within an organisation, what each team member can see is set by the role the organisation gives them.

5. International transfers

Pledzo's data is stored in the United States, and our providers may process it in other countries. Where the law requires, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account and organisation data: for as long as the account is open.
• Donor and supporter data: until the organisation deletes it or closes its account. When an account is closed we delete its data within 30 days, unless the law requires us to keep something longer. Copies in backups are removed as those backups expire.
• Messages to us: as long as needed to deal with them and keep a reasonable record.
• Technical logs: for the short periods our providers keep them.

Organisations can export their donor list and event sheets from Pledzo at any time.

7. Cookies

We use only cookies that Pledzo needs to work:

• Sign-in cookies set by our authentication provider, which keep you signed in.
• org: which of your organisations you are currently viewing.
• sidebar: whether you closed the dashboard sidebar.

Because these cookies are strictly necessary, they do not require consent. You can block cookies in your browser, but you will not be able to sign in.

8. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Each organisation's data is kept separate by database access rules, team members get role-based permissions, invitation links work once and expire after 30 minutes, and changes to key records are logged. No system is perfectly secure; if a breach affects personal information, we will inform the affected organisations and, where required, the authorities without undue delay.

9. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, California's CCPA/CPRA or India's Digital Personal Data Protection Act), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, to withdraw consent, and to not be treated differently for exercising these rights.

To make a request about your Pledzo account, email pledzoteam@gmail.com. We may need to confirm your identity first. If your information is in an organisation's donor records, contact that organisation; we will pass on requests we receive and help them respond. You can also complain to your local data protection authority.

10. Children

Pledzo is a tool for organisations and is not meant for children. We do not knowingly collect information from children under 16 for our own purposes. Organisations are responsible for any information about children they choose to store, including getting a parent's or guardian's consent where the law requires.

11. Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect.

12. Contact

Questions or requests: pledzoteam@gmail.com, or use our contact form. See also our Terms of Service.